Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 10.02.2018 02
Uruchomiony przez STERN WEBER POLSKA (administrator)  ARTUR (11-02-2018 21:32:47)
Uruchomiony z C:\Users\STERN WEBER POLSKA\Downloads
Załadowane profile: STERN WEBER POLSKA (Dostępne profile: STERN WEBER POLSKA)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Guillaume Ryder (hxxp://utilfr42.free.fr)) C:\Program Files\Clavier+\Clavier.exe
(f.lux Software LLC) C:\Users\STERN WEBER POLSKA\AppData\Local\FluxSoftware\Flux\flux.exe
(NirSoft) C:\Users\STERN WEBER POLSKA\Downloads\volumouse_polish\volumouse.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(EJIE Technology) C:\Program Files (x86)\Clover\clover.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\ecmdS.exe [324216 2017-11-04] (ESET)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2479392 2017-12-18] (Malwarebytes Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [Clavier+] => C:\Program Files\Clavier+\Clavier.exe [88576 2010-04-25] (Guillaume Ryder (hxxp://utilfr42.free.fr))
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [F.lux] => C:\Users\STERN WEBER POLSKA\AppData\Local\FluxSoftware\Flux\flux.exe [1678840 2017-10-10] (f.lux Software LLC)
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [$Volumouse$] => C:\Users\STERN WEBER POLSKA\Downloads\volumouse_polish\volumouse.exe [35328 2013-07-15] (NirSoft)
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2017-08-21] (Glarysoft Ltd)
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\MountPoints2: {aca6064d-4599-11e1-ae06-002215a96e88} - F:\LaunchU3.exe -a
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk [2013-02-01]
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
Startup: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SynTPEnh.exe — skrót.lnk [2015-11-27]
ShortcutTarget: SynTPEnh.exe — skrót.lnk -> C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
Startup: C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk *  

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

ProxyServer: [S-1-5-21-3412699975-1278123406-526146009-1000] => 10.0.5.99:80
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 31.11.202.254 37.8.214.2
Tcpip\..\Interfaces\{30EFFC42-6F8C-4C84-A1CB-28A5D8C904BA}: [DhcpNameServer] 31.11.202.254 37.8.214.2
Tcpip\..\Interfaces\{FB8D0857-C5DE-4796-B3AE-374A98636912}: [DhcpNameServer] 192.168.10.10

Internet Explorer:
==================
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.onet.pl/
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
SearchScopes: HKLM -> DefaultScope {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> DefaultScope {3A400C7A-5EA1-4755-BA82-72682E9E73EF} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {10B53F7E-4073-4EDC-9C63-1BD31FE82E8D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {3A400C7A-5EA1-4755-BA82-72682E9E73EF} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO: ExplorerWatcher Class -> {F8A6CAA2-533D-4AED-9E05-8EB19A4021AB} -> C:\Program Files (x86)\Clover\TabHelper64.dll [2013-03-21] (EJIE Technology)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-07-07] (Oracle Corporation)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office_2010\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-07-07] (Oracle Corporation)
Handler: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku

FireFox:
========
FF ProfilePath: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default [2018-02-11]
FF Homepage: Mozilla\Firefox\Profiles\ltk5326a.default -> hxxp://www.wp.pl/
FF Extension: (I don't care about cookies) - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\jid1-KKzOGWgsW3Ao4Q@jetpack.xpi [2017-12-29]
FF Extension: (uBlock) - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2015-12-04] [Przestarzałe]
FF Extension: (FireFTP) - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2017-05-30] [Przestarzałe]
FF Extension: (Video DownloadHelper) - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2018-02-07]
FF Extension: (Adblock Plus) - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-06] [Przestarzałe]
FF SearchPlugin: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\searchplugins\duckduckgo.xml [2015-11-05]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => nie znaleziono
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => nie znaleziono
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_161.dll [2018-02-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2016-04-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\PROGRA~1\TRACKE~1\PDFVIE~1\npPDFXCviewNPPlugin.dll [Brak pliku]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_161.dll [2018-02-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-07-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-07-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\OFFICE~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\OFFICE~1\Office14\NPSPWRAP.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2016-04-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\PROGRA~1\TRACKE~1\PDFVIE~1\Win32\npPDFXCviewNPPlugin.dll [Brak pliku]
FF Plugin HKU\.DEFAULT: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2016-04-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3412699975-1278123406-526146009-1000: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2016-04-19] (Tracker Software Products (Canada) Ltd.)

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [Brak podpisu cyfrowego]
S3 Cloud Station Drive VSS Service x64; C:\Program Files (x86)\Synology\CloudStation\bin\vss-service-x64.exe [287240 2016-03-16] () [Brak podpisu cyfrowego]
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2648184 2017-11-04] (ESET)
S4 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Brak podpisu cyfrowego]
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [153888 2017-12-18] (Malwarebytes Corporation)
S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2013-01-17] (Puran Software) [Brak podpisu cyfrowego]
S3 Unchecky; C:\Program Files (x86)\Unchecky\bin\Unchecky_svc.exe [163576 2015-08-05] (RaMMicHaeL)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-11-04] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [107344 2017-05-04] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180088 2017-11-04] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [50752 2017-05-04] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [78192 2017-05-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60544 2017-05-04] (ESET)
R1 epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [102160 2017-11-04] (ESET)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] () [Brak podpisu cyfrowego]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2012-12-21] () [Brak podpisu cyfrowego]
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [76192 2017-12-18] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] () [Brak podpisu cyfrowego]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2012-12-21] () [Brak podpisu cyfrowego]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-11-16] (Glarysoft Ltd)
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-02-11 21:32 - 2018-02-11 21:34 - 000018142 _____ C:\Users\STERN WEBER POLSKA\Downloads\FRST.txt
2018-02-11 21:32 - 2018-02-11 21:32 - 002404864 _____ (Farbar) C:\Users\STERN WEBER POLSKA\Downloads\FRST64.exe
2018-02-11 21:32 - 2018-02-11 21:32 - 000000000 ____D C:\FRST
2018-02-11 19:05 - 2018-02-11 19:05 - 000108088 _____ C:\Users\STERN WEBER POLSKA\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-11 19:04 - 2018-02-11 19:04 - 000432384 _____ C:\Windows\system32\FNTCACHE.DAT
2018-02-08 22:53 - 2018-02-08 22:53 - 000210015 _____ C:\Users\STERN WEBER POLSKA\Desktop\med-wniosek medfinance_STOMAX.docm
2018-02-05 18:15 - 2018-02-05 18:15 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\siemens_finance_kreator_umow
2018-02-02 16:23 - 2018-02-02 16:23 - 000120752 _____ C:\Users\STERN WEBER POLSKA\Downloads\WyciagKarta_20180202_162215.pdf
2018-01-30 15:03 - 2018-02-02 18:36 - 000000000 ____D C:\Users\STERN WEBER POLSKA\Desktop\BLUEMED
2018-01-12 11:36 - 2018-01-12 11:36 - 000413184 _____ C:\Users\STERN WEBER POLSKA\Desktop\02 SFS_leasing_operacyjny_Czarnecki.xls

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-02-11 20:53 - 2009-07-14 05:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-11 20:53 - 2009-07-14 05:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-11 19:33 - 2012-02-21 15:36 - 000000000 ___SD C:\Users\STERN WEBER POLSKA\AppData\LocalLow\Temp
2018-02-11 19:23 - 2017-05-30 10:34 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\LocalLow\Mozilla
2018-02-11 19:12 - 2015-02-06 10:20 - 000000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2018-02-11 19:04 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-11 19:02 - 2015-04-13 13:50 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\MPC-HC
2018-02-11 19:02 - 2013-03-27 23:11 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\TeraCopy
2018-02-11 09:15 - 2016-06-17 20:43 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\Adobe
2018-02-11 09:15 - 2015-12-04 16:26 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-02-11 09:15 - 2015-12-04 16:26 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-02-11 09:15 - 2011-10-26 12:11 - 000000000 ____D C:\Windows\system32\Macromed
2018-02-11 09:15 - 2011-07-10 08:01 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-02-10 21:12 - 2013-02-17 21:54 - 000000000 ____D C:\ProgramData\TEMP
2018-02-10 12:40 - 2011-02-14 10:01 - 000740688 _____ C:\Windows\system32\perfh015.dat
2018-02-10 12:40 - 2011-02-14 10:01 - 000156230 _____ C:\Windows\system32\perfc015.dat
2018-02-10 12:40 - 2009-07-14 06:13 - 001670590 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-10 12:40 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-05 18:15 - 2016-12-06 10:42 - 000000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\SquirrelTemp
2018-02-03 12:08 - 2014-06-25 09:05 - 000000000 ____D C:\Program Files (x86)\Glary Utilities 5
2018-02-03 12:06 - 2015-05-14 22:50 - 000000000 ____D C:\Program Files (x86)\Unchecky
2018-02-03 12:06 - 2013-03-24 19:27 - 000000000 ____D C:\Program Files (x86)\AC3Filter
2018-02-03 12:06 - 2013-02-16 12:43 - 000000000 ____D C:\Users\STERN WEBER POLSKA\Downloads\Instalki
2018-02-03 12:06 - 2013-01-31 21:06 - 000000000 ____D C:\Program Files\CCleaner
2018-02-03 11:18 - 2014-01-23 08:58 - 000000000 ____D C:\Users\STERN WEBER POLSKA\Downloads\GlaryUtilitiesPRO44
2018-02-02 10:01 - 2013-02-01 21:11 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2018-01-20 18:30 - 2009-07-14 06:08 - 000032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Pliki w katalogu głównym wybranych folderów =======

2013-02-16 12:26 - 2013-01-29 11:21 - 000654936 _____ (Sysinternals - www.sysinternals.com) C:\Program Files\autoruns.exe
2013-02-08 21:03 - 2013-02-08 21:36 - 001090153 _____ () C:\Program Files\Autoruns.zip
2013-02-09 14:32 - 2013-02-06 01:33 - 001252424 _____ (Wieldraaijer) C:\Program Files\CheckDiskGUI.exe
2013-02-09 14:33 - 2013-02-09 14:33 - 000000928 _____ () C:\Program Files\CheckDiskGUI.ini
2013-02-02 00:12 - 2011-04-28 14:10 - 000446464 _____ (OldTimer Tools) C:\Program Files\TFC.exe
2013-02-04 00:44 - 2014-03-18 16:24 - 000000339 _____ () C:\Users\STERN WEBER POLSKA\AppData\Roaming\prio.ini
2014-03-12 15:09 - 2014-03-12 15:18 - 000004608 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-01 13:21 - 2013-10-01 13:21 - 000000781 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\recently-used.xbel
2013-02-02 01:25 - 2014-05-25 16:40 - 000007648 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-02-08 18:18

==================== Koniec  FRST.txt ============================